The present invention relates to a method for controlling a automated gearbox, an electronic safety system and an adapter plug.
Methods for controlling an automated gearbox, electronic safety systems and adapter plugs are already known.
An object of the present invention is to provide a novel method for controlling an automated gearbox, a novel electronic safety system and a novel adapter plug, that is, a novel method for controlling an automated gearbox or an electronic safety system or an adapter plug.
The present invention provides an electronic safety system which has at least one of the features that are described in the following description or the claims or are shown in the figures.
The present invention also provides an adapter plug or adapter connector, which has at least one of the features that are described in the following description or the claims or are shown in the figures.
According to the present invention, in particular a method for controlling an automated gearbox of a motor vehicle is proposed, in which in normal operation of the motor vehicle a wire harness connector is coupled with a control unit connector, which produces a plurality of contact connections between the wire harness and the electronic control unit. In conjunction with initial start of the automated gearbox or predefined components of the motor vehicle, an adapter plug is inserted between a wire harness plug connector linked to the wire harness and a control unit connector. The adapter plug interrupts part of the contact connections.
Connectors may be in particular plugs or plug sockets or the like, and the term “adapter plug” as used herein, may refer to any intermediate connector, including a plug, a socket, a cable, or any other electrical connecting device.
In particular, the present invention provides an electronic control unit to control predefined functionalities, such as functionalities of the automated gearbox. This electronic control unit is able to control the functionalities of various or individual components. For example, without the present invention being limited thereby, such an electronic control unit is also able to control clutch functionalities or engine functionalities. For example, the electronic control unit may be a clutch control unit or a transmission control unit or an engine control unit or a master control unit or the like. The present invention is not intended to be limited by these forms of the control unit, however. The electronic control unit has a main processor, on which function software may run which is able to control the predefined functionalities of the motor vehicle or of the automated gearbox or the like.
Also provided is an electronic safety system, which is able to determine safety-critical operating conditions of the motor vehicle in advance. The electronic safety system has a redundant processor. The electronic safety system also has monitoring software.
An exemplary electronic safety system is offered by the applicant under the name “intelligent Safety Monitoring System (ISM).”
The intermediate connector may be in particular an adapter plug or an adapter cable, or may have such an adapter plug or adapter cable.
In a preferred design, this intermediate connector is designed in such a way that it interrupts at least part of the connections between the wire harness plug connector and the control unit connector which would exist in a direct connection between the wire harness plug connector and the control unit connector. The intermediate connector may be designed in such a way that all or part of these connections are interrupted.
In a preferred design, at least two contact connections which are able to transmit signals in normal operation are interrupted by the intermediate connector. Particularly preferred are two contact connections which are able to transmit signals in normal operation and which are independent of each other are interrupted by the intermediate connector.
In a particularly preferred design, when the intermediate connector is installed, driving operation of the motor vehicle is possible only to a limited extent or not at all.
This may be effected in particular through appropriate adjustment of the intermediate connector or adapter plug using appropriate software.
The present invention provides a method for controlling an automated gearbox of a motor vehicle comprising:                providing an electronic control unit having a main processor;        controlling a predefined functionality of the motor vehicle using a function software running on the main processor under predefined conditions;        detecting a safety-critical operating state of the motor vehicle in advance using an electronic safety system having a redundant processor and a monitoring software;        performing a startup of the electronic control unit; and        in conjunction with the startup, at least partially deactivating the monitoring software, and activating a substitute monitoring software.        
According to the present invention, in the course of the initial start of the electronic control unit, the monitoring software is at least partially deactivated, and instead substitute monitoring software is activated.
The present invention provides a method for controlling an automated gearbox of a motor vehicle comprising:                providing an electronic control unit having a main processor;        controlling a predefined functionality of the automated gearbox using a function software running on the main processor under predefined conditions;        detecting a safety-critical operating state of the motor vehicle in advance using an electronic safety system having a redundant processor and a monitoring software;        monitoring at least one of a functionality of the main processor and a functionality of a predefined process running on the main processor during normal operation using the monitoring software;        determining whether a predefined impairment of a functions exists;        wherein, if a predefined impairment is determined to exist during normal operation, performing at least one of a shut-off of a final stage of at least one actuator, and a reset of the electronic control unit;        performing a startup of the electronic control unit; and        in conjunction with the startup, transmitting a signal that suppresses, during the startup, the at least one of the shutoff of the final stage and the reset of the electronic control unit caused by the determination of the impairment.        
According to the present invention, it is provided in particular that by using the monitoring software in normal operation, the functionality of the main processor and/or of predefined processes running on the main processor is monitored, and information is conveyed as to whether predefined impairments of functions exist. In particular, in normal operation of the vehicle or of the control unit the final stage of at least one actuator or of the control unit is shut off and/or a reset of the electronic control unit is produced when such an impairment of functions has been detected. In conjunction with the start of the motor vehicle, or of at least one predefined component of the motor vehicle, and in particular the electronic control unit, during start a signal causes a shut-off of the final stages, which is triggered by detection of an error, and/or a reset of the control unit is suppressed. The signal which causes the shut-off of the final stages or suppresses a reset of the ASG control unit in the manner described above may be output for example by an electronic tester.
Particularly preferred is also the combination of the aforementioned designs, so that by using a tester or a signal output by a tester it is possible to switch over from the monitoring software to the substitute monitoring software and/or vice versa.
In a preferred embodiment, the substitute monitoring software is designed so that it is unable to shut off the final stages, or prevents such a shut-off. Furthermore, this substitute monitoring software is preferably designed so that it makes correct communication possible between a monitoring processor and the main processor or between the monitoring processor and substitute monitoring software stored in the main processor.
In particular, the monitoring software is designed so that it prevents a reset of the control unit.
A particularly preferred design includes the provision that in normal operation the monitoring software and the monitoring processor check each other through a question-and-answer routine. This question-and-answer routine is preferably designed so that the monitoring processor sends predefined questions to the monitoring software, which is particularly preferably stored in the main processor, and receives corresponding responses from this monitoring software. A particularly preferred provision is that predefined desired responses are stored in the monitoring processor, and the monitoring processor indicates an error if the desired responses do not match the actual responses.
A particularly preferred design includes the provision that the monitoring software recalls the responses or corresponding characteristic values from the memory of the electronic controller, in particular an ASG control unit.
A particularly preferred provision is that in conjunction with a start of the motor vehicle or at least one of its components, such as the ASG control unit, or in conjunction with a shop test, correct responses are temporarily written into the memory of the electronic control unit. This writing of the correct responses may be produced for example using an external electronic tester.
In a preferred design, in conjunction with the conclusion of the startup, predefined memory contents of the control unit, such as an ASG control unit, are modified and in particular are overwritten.
A particularly preferred provision is that such memory contents are correct answers, which are called up by the monitoring software when the monitoring processor directs questions to the monitoring software or the main processor in conjunction with the start or in conjunction with a shop routine.
It is particularly preferred that, in conjunction with the startup, a signal link is established between the electronic control unit and an external electronic tester.
An electronic tester is in particular a hand-held tester.
A particularly preferred provision is that, after a normal completion of the start and/or of a shop test, or when communication between an electronic control unit and an electronic tester is lost, predefined memory contents of the control unit are overwritten.
A particularly preferred provision is that in such situations a reset of the control unit is triggered. In particular in conjunction with such a reset, memory contents of the control unit may also be overwritten or modified.
It is particularly preferred that, in conjunction with a reset of the electronic control unit and/or after a normal completion of the start and/or of a shop test, and/or if communication is lost between the electronic tester and the electronic control unit after a start and/or a shop test, the monitoring software is reactivated and the substitute monitoring software is deactivated or erased.
A particularly preferred provision is that the modified memory contents are neutral information.
The present invention provides a method for controlling an automated gearbox of a motor vehicle, comprising:                providing an electronic control unit having a main processor;        controlling a predefined functionality of the automated gearbox using a function software running on the main processor under predefined conditions;        detecting a safety-critical operating state of the motor vehicle in advance using an electronic safety system having a redundant processor and a monitoring software;        providing an error message upon detection of a predefined impairment of the functionality by the electronic safety system; and        at least limiting a monitoring activity of at least one the electronic safety system and the monitoring software and/or providing an error message upon detection of a predefined impairment of the functionality by the electronic safety system only if the electronic safety system recognizes an error when the control unit is not in an initialization phase.        
According to the present invention, it is provided in particular that the electronic safety system displays an error message if it detects predefined impairments of functions, this monitoring activity or this displaying of errors by the electronic safety system and/or its monitoring software being at least limited if it is reported to the electronic safety system that the electronic control unit is in an initialization phase.
According to the present invention, it is provided in particular that the electronic safety system assumes its monitoring activity to the full extent after a delay; i.e., that it first waits for the completion of the initialization phase of the control unit before this monitoring activity is performed in its entirety.
The error that is displayed when predefined impairments of functions are detected, in particular outside of the initialization phase of the control unit, may be signaled in particular in such a way that a reset of the control unit is triggered, and/or in such a way that the final stages of actuators of this control unit are shut off, or in some other manner.
In a particularly preferred design, in the initialization phase of the control unit the final stages of these actuators are shut off right from the start.
Preferably in the initialization phase of the control unit at least one signal is sent to the electronic safety system indicating that the electronic control unit is in the initialization phase.
It is particularly preferred that this signal may be in particular a type of permanent signal that is emitted constantly or at certain time intervals, in particular short intervals, when the electronic control unit is in the initialization phase.
In conjunction with the present invention, such an indication of the initialization phase, occurring constantly or at short time intervals, is also referred to in particular as active indication.
A particularly preferred provision is that this signal, which indicates that the electronic control unit is in the initialization phase, is deleted from the electronic safety system after reception. A preferred provision is that the electronic safety system assumes its full monitoring activity and/or, in the event that errors are detected, indicates these errors, when it no longer receives the signal that indicates the initialization phase of the control unit, in particular continuously or at predefined time intervals that are shorter than a predefined limiting time interval. A preferred provision is that in this case the final stages of the actuators of the automated gearbox are enabled again, if they were shut off earlier at the beginning of the initialization phase.
In a preferred design, the signal that indicates to the electronic safety system that the electronic control unit is in the initialization phase is emitted and/or generated using the function software.
A particularly preferred provision is that the electronic safety system assumes its full monitoring activity when it no longer receives the signal that indicates the initialization phase, and that it enables the final stages of the actuators of the automated gearbox when it recognizes no processor errors from the main processor. A particularly preferred provision is that after the final stages have been enabled the normal driving operation may be assumed by the function software.
A particularly preferred provision is that the final stages are shut off again and the control unit is reset if a processor error is detected at the function level or in the function software or the main processor by the electronic safety system. Also preferred is that the final stages of the actuator are shut off if the electronic control unit is shut off, which may also be in particular at the end of an operating phase.
In a preferred design, the signal that indicates the initialization phase of the electronic control unit has two or more redundant partial signals or two or more redundant variables.
Such variables may in particular be designed in such a way that each of them has a unique bit pattern.
A particularly preferred provision is that the electronic safety system only accepts the initialization mode when each of these variables indicates a value specified therefor.
Preferably two such variables are provided, which are set to the value-complement pair.
Also preferred is that the final stages are switched on when the electronic safety system no longer receives a signal that indicates that the electronic control unit is in the initialization phase.
Also preferred is that the electronic safety system accepts the initialization phase of the electronic unit, if this initialization phase is indicated by a signal that has two partial signals, and at least one of these two partial signals indicates a predefined value.
An error response of the electronic safety system when a predefined error is detected, in particular from the main processor, may be that the final stages are switched off, or in some other manner. For example, it may also be provided that the particular error case switching state of the final stage is preserved.
The present invention provides a method for controlling an automated gearbox of a motor vehicle, comprising:                providing an electronic control unit having a main processor;        controlling a predefined functionality of the automated gearbox using a function software running on the main processor under predefined conditions;        detecting a safety-critical operating state of the motor vehicle in advance using an electronic safety system having a redundant processor and a monitoring software;        adapting at least one touch point of a clutch unit in normal operation according to at least one predefined characteristic; and        monitoring a result of the adapting of the touch point using the electronic safety system.        
According to the present invention, a clutch unit is provided, and for at least one touch point of this clutch unit to be adapted in normal operation according to at least one predefined characteristic.
Furthermore, it is provided in particular that the electronic safety system monitors results of the touch point adaptation.
The clutch unit is preferably a friction clutch unit. It is particularly preferred that the clutch unit is a computerized clutch unit. An example of such a computerized clutch unit is offered by the applicant under the name “Electronic Clutch Management (ECM).”
A touch point is in particular a position of the clutch unit in which the clutch unit is able to transfer a predefined low torque, for example 0.5 Nm or 5 Nm. It should be pointed out that the concept of the touch point is not meant to be limited to the indicated transferable torque, but rather that other predefined torque values are also involved.
According to the present invention, it is provided in particular that from time to time, in particular at predefined time intervals or depending on predefined operating situations, the touch point is adapted.
The particular background is that the assignment of the predefined torque to a predefined clutch position, which is registered in particular using a position sensing device or in some other manner, may change. Such changes may be produced for example by clutch wear or by temperature effects or, if a hydraulic actuating device is included, by air bubbles in the hydraulic column or in some other way, without the present invention being limited thereby.
In a preferred design the electronic safety system does not monitor the actual process of the touch point adaptation, but only its result. This is not intended to limit the present invention, however, so that in principle the execution of the adaptation routines may also be monitored in addition or alternatively. The adaptation routines are preferably intended for the touch point and the position of the clutch unit and detected distance to be coordinated in such a way that based on the detected distance or the corresponding indicated position values of the clutch unit it is possible to determine when or whether the predefined torque is transmissible by the clutch unit, namely as the maximum torque transmissible by the clutch unit in this position.
In a preferred design, the electronic safety system monitors whether the position of the touch point has changed compared to a previous check and/or since the previous touch point adaptation.
A particularly preferred provision is that the electronic safety system monitors whether the change in the position of the touch point compared to the last check and/or compared to the result of the last touch point adaptation lies within a predefined tolerance field or has changed by less than a predefined value compared to the last touch point. This value may be a difference of values having a positive and/or negative sign.
Preferably it is provided that a distinction is made between different touch points or touch point adaptations. It is particularly preferred that a distinction is made between a long-term touch point or long-term touch point adaptation and a short-term touch point or short-term touch point adaptation, the short-term touch point adaptation or short-term touch point referring to dynamically rapidly changing touch points and the long-term touch point or long-term touch point adaptation referring to the dynamically comparatively slowly changing touch points.
For example, without the present invention being limited thereby, a dynamically long-term shift in touch point may be caused by clutch wear. Also mentioned as an example, without intending to limit the present invention thereby, a short-term touch point adaptation or short-term touch point may refer to a short-term touch point change, for example touch point changes that are caused by temperature effects.
Preferably, the results of the long-term touch point adaptation as well as the results of the short-term touch point adaptation are monitored by the electronic safety system.
In a preferred design, the electronic control unit implements a control strategy which causes the short-term touch point to be set to the long-term touch point under predefined conditions, or to be reset to the long-term touch point from time to time. Purely as an example, without intending to limit the present invention thereby, there may be a provision that in the case of a clutch actuating device having a hydraulic section this hydraulic section is purged from time to time, and/or at least a segment of this hydraulic section is set to a defined setpoint size from time to time. This may be effected for example by the hydraulic section having an opening at a predefined location and this opening forming a connecting or snifter bore between the hydraulic section and a storage tank filled with hydraulic medium. An element applying pressure to the hydraulic section, such as pistons or the like, may be moved from time to time in such a way that the hydraulic section is connected with the hydraulic storage tank via the snifter bore. The element such as pistons applying pressure to the hydraulic section may then be moved again over the snifter bore, so that after the element has completely moved over the snifter bore the hydraulic section has a predefined, reproducible length. This “sniffing” is able to change the touch point, in particular the short-term touch point. As a result, it is possible, for example, after such “sniffing,” for the short-term touch point to be reset to the long-term touch point.
In a preferred design, the short-term touch point and the long-term touch point are each monitored individually by the electronic safety system.
A particularly preferred provision is that in conjunction with the monitoring of the results of the touch point adaptation performed by the electronic safety system, a check is performed of whether the elapsed time period since the previous touch point adaptation and/or since the previous check is greater than a predefined limiting period.
Also preferred is the fact that the electronic safety system indicates an error if the touch point was changed in conjunction with the touch point adaptation by an amount that is greater than a predefined limiting value and/or if a time period has elapsed since the last touch point adaptation and monitoring that is shorter than a predefined limiting time period.
A particularly preferred provision is that this limiting value and/or this limiting time period are set to different values for the long-term touch point and for the short-term touch point.
The present invention provides a method for controlling an automated gearbox of a motor vehicle, comprising:                providing an electronic control unit having a main processor;        controlling a predefined functionality of the automated gearbox using a function software running on the main processor under predefined conditions;        detecting a safety-critical operating state of the motor vehicle in advance using an electronic safety system having a redundant processor, a monitoring software and a plurality of function blocks.        
According to the present invention, in particular a method for controlling an automated gearbox of a motor vehicle is provided, in which an electronic safety system having a plurality of function blocks is provided or used.
In a preferred design, these function blocks are modularly separated from each other.
Preferably, a first function block of the electronic safety system is provided, in which a check is performed of whether predefined input signals describe the operating state of the motor vehicle and/or of the clutch unit of the motor vehicle and/or of the transmission unit of the motor vehicle in a plausible manner. This function block is also referred to as the “signal plausibility check” function block.
Possible input signals for example are those that characterize the operating state of the motor vehicle and/or of the automated gearbox, such as the engine speed and the vehicle velocity.
Preferably input signals are also provided which are determined in the actual transmission control or in the functional level or by the function software, and which influence the operation of the motor vehicle and/or of the transmission.
Preferably a second function block of the electronic safety system is provided in which a decision is made, depending on plausible signals, as to which operating states will be monitored for safety-critical situations.
This function block is also referred to as the “situation recognition” function block.
The plausible signals are in particular those signals that are output signals of the first function block. For example, without intending to limit the present invention thereby, a determination of this sort may be such that when the vehicle is stopped, or triggered by signals that indicate that the vehicle is stopped, unwanted start is prevented, or that when the vehicle is moving or in the presence of signals that indicate that the vehicle is moving, shifting into an excessively low gear is prevented according to a predefined characteristic. However, a great number of additional or other options are possible and preferred when determining the safety-critical events to be monitored.
In a preferred design, a third function block of the electronic safety system is provided, in which a check is performed of whether impermissible control strategies are being introduced at the functional level of the electronic control unit.
This function block is also referred to as the “action monitoring” function block.
The function level of the electronic control unit is in particular an area that includes the function software.
A preferred provision is that as input signals to the third, “action monitoring” function block the input signals are provided that characterize the operating state of the motor vehicle or of the automated gearbox and are checked for plausibility (plausible or plausibility-checked vehicle signals), as well as the input signals that are determined in the actual transmission controller, and in particular are intended for operating the transmission. These last-named signals are also referred to as function-level signals.
In addition to the plausible vehicle signals and the function-level signals, preferably the output signals of the second function block are provided as input signals to the third function block.
A particularly preferred provision is that an analysis is performed in the third, “action monitoring” function block to determine whether the function level signals are in harmony with the plausible vehicle signals. For example, without intending to limit the present invention thereby, it is possible among other things to determine from the current vehicle speed the lowest permissible gear, with which the gear requested or selected by the function level is then compared. A preferred design provides that, in the event that an error is detected in the third, “action monitoring” function block that error is displayed.
In particular, provision is made that a corresponding error signal is sent to the fifth signal block, which will be explained below. A particularly preferred design provides that signals which indicate action variables of the function monitoring that have been checked for plausibility are sent from the “action monitoring” function block to the fourth function block, which is also referred to as the “actuator monitoring” function block.
It is particularly preferred that a fourth action block is provided, which is also referred to as the “actuator monitoring” function block.
Preferably, a check is performed in the “actuator monitoring” function block to determine whether plausibility-checked action variables are being implemented correctly by the transmission and/or clutch actuators. If an error is detected here, it is particularly preferred that an error signal is activated or an error is displayed. This error is preferably reported to a fifth function block.
Preferably output signals of a third function block and/or the system input signals, which are function-level signals, and/or plausibility-checked vehicle signals, which may be in particular output signals of the first function block, are present as input signals at the “actuator monitoring” function block.
In a preferred design, a fifth function block is also provided.
This function block is also referred to as the “error handling” function block. A preferred design provides that a decision is made in the “error handling” function block as to whether an error response should be triggered. Such an error response may be for example to shut off the power electronics which are used to control the transmission or clutch actuators. Furthermore, in addition or alternatively, a reset, i.e. in particular a restart of the electronic control unit may be requested or triggered by the “error handling” function block.
The present invention provides a method for controlling an automated gearbox of a motor vehicle, comprising:                providing an electronic control unit having a main processor;        controlling a predefined functionality of the automated gearbox using a function software running on the main processor under predefined conditions;        detecting a safety-critical operating state of the motor vehicle in advance using an electronic safety system having a redundant processor and a monitoring software;        determining a reference position of the transmission under predefined conditions in conjunction with at least one neutral reference run;        monitoring the at least one neutral reference run using the electronic safety system; and        detecting a change in position in relation to the reference position using an incremental distance measuring device.        
According to the present invention, it is provided in particular for an incremental distance measurement to be performed using an incremental distance measuring device. This incremental distance measurement makes it possible to register transmission positions as relative positions in reference to a relative location. The reference position is ascertained under predefined conditions in conjunction with a neutral reference run. This neutral reference run is a predefined operation whereby the assignment of transmission positions to positions or distances that are indicated by incremental distance measuring devices may be verified, created or restored.
In particular, provision is made for the neutral reference run to be performed for example after a loss of the forenamed assignment, which may occur for example as a result of a control unit reset. Preferably unwanted interactions with the clutch control are thus avoided.
In particular, according to the present invention such neutral reference runs are monitored by the electronic safety system.
A preferred provision is that the electronic safety system distinguishes between different neutral reference run states, depending on certain neutral reference run conditions.
In particular, it is possible to distinguish the following five examples of neutral reference run states: “neutral reference run inactive,” “neutral reference run expected,” “neutral reference run cyclically active,” “neutral reference run necessarily active” and “transmission positions matched.”
The state “neutral reference run inactive” is in particular a state that exists in normal driving operation, and in which no specific monitoring takes place for neutral reference operation. In this state, the electronic safety system monitors only normal operation.
The state “neutral reference run cyclically active” is in particular a state in which the electronic safety system expects that the clutch will be held completely disengaged. It is particularly preferred that, neutral reference runs are conducted cyclically in this state. In particular, it is provided that neutral reference runs that are conducted in this state for confirmation may be interrupted at any time.
The state “neutral reference run necessarily active” checks the electronic safety system to determine whether the clutch is being held completely disengaged. In this state, the electronic safety system conducts a plausibility assessment in regard to the outcome of the neutral reference run.
In the state “neutral reference run expected” there must be no gear changes; this is monitored by the electronic safety system.
In the state “match transmission positions,” the electronic safety system, like the normal transmission controller, assigns the incremental measurement values or indicated settings to certain transmission positions.
In particular, it is provided for the electronic safety system to trigger an error message if it ascertains in these states that the particular conditions are not met.
In a preferred design, the electronic safety system monitors predefined operating states depending on neutral reference run states.
A preferred provision is that the first neutral reference run state “neutral reference run inactive” exists if the control unit was first initialized and the control unit was not shut off in the last operating phase by a reset. The first neutral reference run state may also exist if the transmission positions were matched. The first neutral reference run state further exists preferably if a neutral reference run was ended without matching and the neutral reference run state “neutral reference run cyclically active” existed beforehand.
The second neutral reference run state “neutral reference run expected” exists in particular if initialization of the electronic control unit took place beforehand and the electronic control unit was shut off in the last operating phase by a reset.
The state “neutral reference run expected” may also exist or does exist if, in particular after the state “neutral reference run inactive,” it was ascertained on the basis of a predefined characteristic that the detected transmission positions are implausible transmission positions.
The neutral reference run state “neutral reference run cyclically active” exists in particular if the first neutral reference run state existed beforehand and the function level or function software has caused a neutral reference run to be begun—in particular when it is begun where there is a large degree of confidence in regard to the correctness of the current reference position. For assessing the magnitude of the degree of confidence, a corresponding predefined characteristic may be provided and/or stored.
The neutral reference run state “neutral reference run necessarily active” exists in particular if the first neutral reference run state “neutral reference run inactive” existed beforehand and the function level or function software has caused a neutral reference run to be begun—in particular where there is a low degree of confidence in regard to the correctness of the current reference position.
The neutral reference run state “neutral reference run necessarily active” also exists in particular if the neutral reference run state “neutral reference run expected” existed beforehand and the function level or function software causes a neutral reference run to be started.
The fifth neutral reference run state “match transmission positions” exists in particular if the neutral reference run state “neutral reference run necessarily active” existed beforehand and the function level or function software causes the neutral reference run to be ended where there is a sufficient degree of confidence and after an adequate movement of the transmission selector lever. The specification of an adequate movement of the selector lever may be prescribed according to a predefined characteristic.
The fifth neutral reference run state “match transmission positions” also exists in particular if the neutral reference run state “neutral reference run cyclically active” existed beforehand and the function level or function software ended the neutral reference run with a matching, i.e. in particular with a matching of the positions.
The present invention provides a method for controlling an automated gearbox of a motor vehicle, comprising:                providing an electronic control unit having a main processor;        controlling a predefined functionality of the automated gearbox using a function software running on the main processor under predefined conditions;        detecting a safety-critical operating state of the motor vehicle in advance using an electronic safety system having a redundant processor and a monitoring software;        determining the gear selected in the transmission unit under predefined conditions and indicating the gear selected in a display; and        determining the gear selected in the transmission unit using the electronic safety system and comparing it with the gear indicated in the display.        
According to the present invention, in particular the gear selected in the transmission unit is ascertained, at least in normal operation, and is indicated in a display. The electronic safety system also ascertains the gear selected in the transmission unit, in particular redundantly. The electronic safety system then compares the gear ascertained by this electronic safety system with the gear indicated in the display.
Preferably, the electronic safety system detects a lack of agreement between the gear ascertained by the electronic safety system and the gear indicated in the display if the identities of these gears differ.
Preferably the electronic safety systems checks whether the reverse gear is indicated in the display when a forward gear is selected in the transmission unit, or vice versa.
It is particularly preferred that the electronic safety system detects a lack of agreement between the gear ascertained by the electronic safety system and the gear indicated in the display, if the electronic safety system determines that a forward gear is selected in the transmission unit and reverse gear is indicated in the display, or vice versa.
In a preferred design, the electronic safety system indicates an error if a forward gear is indicated in the display when reverse gear is selected in the transmission unit or vice versa, and the clutch unit is to be further or increasingly engaged and/or is further engaged.
Preferably, the electronic safety system indicates an error if a forward gear is indicated in the display when reverse gear is selected in the transmission unit or is ascertained by the electronic safety system, or vice versa, and this lack of agreement exists for a time period that is longer than a predefined limiting time period. This limiting time period may be adjustable, if appropriate.
The present invention provides a method for controlling an automated gearbox of a motor vehicle, comprising:                providing an electronic control unit having a main processor;        controlling a predefined functionality of the automated gearbox using a function software running on the main processor under predefined conditions;        detecting a safety-critical operating state of the motor vehicle in advance using an electronic safety system having a redundant processor and a monitoring software;        detecting a safety-critical operating state of the motor vehicle in advance using an electronic safety system having a redundant processor and a monitoring software;        in conjunction with an initialization of the electronic control unit, performing a check to determine whether the electronic control unit was shut off in a previous operating phase normally, or by a reset of the control unit;        if the electronic control unit was shut off normally in the previous operating phase, monitoring the gear indication in a passive mode according to a predefined characteristic, the passive mode being a standard monitoring mode of the electronic safety systems for the gear indication; and        if the electronic control unit was not shut off in the previous operating phase by a reset of the control unit in the previous operating phase, influencing the gear indication according to a predefined characteristic in an active mode that differs from the passive mode using the electronic safety system.        
According to the present invention, in particular the gear selected in the transmission unit is ascertained, at least in interference-free normal operation, and is indicated in a display, using a gear detection device that is preferably not associated with the electronic safety system. During or in conjunction with the initialization of the electronic control unit a check is performed to determine whether the electronic control unit was shut off in the previous operating phase by a reset of the control unit, or normally, i.e. not by a reset of the control unit. In particular, this is checked by the electronic safety system.
If it is found during this check that the electronic control unit was shut off normally in the previous operating phase, the electronic safety system monitors the gear display in a passive mode according to a predefined characteristic. This passive mode of gear monitoring is preferably the standard monitoring mode of the electronic safety system for the gear display
If it is found during this check that the electronic control unit was shut off in the previous operating phase by a reset of the control unit, the electronic safety system influences the gear display according to a predefined characteristic in active mode or in gear indication active mode. This gear indication active mode differs from the passive mode and from the gear indication passive mode.
In a preferred design, the electronic safety system changes the gear indication or the data shown in the display in active mode.
In a preferred design, the electronic safety system monitors the correct execution of the gear indication changed by the electronic safety system in active mode, in particular supplementally.
A particularly preferred provision is that the electronic safety system is switched back from active mode to passive mode when the transmission settings or the information about the currently selected gear have been verified by a neutral reference run.
A preferred provision is that an additional change from passive mode to active mode is provided in the event that uncertainty about the transmission position is detected again during driving operation on the basis of predefined criteria. But it is also preferred that no other change is provided.
A preferred design provides that an error identification is indicated in the display (the gear display) in active mode. It is also preferred that it be indicated in the display that the electronic safety system is in active mode.
Also preferred is that nothing be shown in the display in active mode.
The present invention provides a method for controlling an automated gearbox of a motor vehicle, comprising:                providing an electronic control unit having a main processor;        controlling a predefined functionality of the automated gearbox using a function software running on the main processor under predefined conditions;        detecting a safety-critical operating state of the motor vehicle in advance using an electronic safety system having a redundant processor and a monitoring software; and        monitoring whether the motor vehicle is starting to move without an existence of a corresponding driver intent using the electronic safety system.        
According to the present invention, it is provided in particular for the electronic safety system to monitor whether the motor vehicle starts moving without the existence of a driver intent to that effect, or although there is no corresponding start intent of the driver.
Whether or not there is a driver intent for start may be checked on the basis of predefined criteria. Such criteria may depend in particular on control functionalities of the motor vehicle. For example, it is possible to define that a start intent exists if the driver operates the accelerator pedal. A start intent may also be defined as existing in the event that when a gear is selected, the engine is running, and a braking device of the motor vehicle, in particular the operating brake system, is released.
Other designs for ascertaining a start intent are also preferred.
In a preferred design, the start monitoring is a functionality that is not performed constantly, but only in situations in which the engine of the motor vehicle, such as an internal combustion engine, is running while the motor vehicle is stopped or is moving at a speed that is lower than a predefined limiting speed. In a preferred design, start monitoring is started depending on the engine speed and/or depending on the vehicle speed.
For example, it may be provided that the start monitoring is started when the vehicle speed is lower than a predefined limit for the vehicle speed, and the engine speed is higher than a predefined limit for the engine speed.
In a particularly preferred design, the start monitoring has various sub-functionalities. It is particularly preferred that, there may be provision for the sub-functionalities to be performed depending on whether or not a gear is selected in the transmission unit.
A particularly preferred provision is that when there is no start intent the system monitors whether the setpoint clutch torque is smaller than the creep torque or measuring torque.
The creep torque is in particular a torque which causes the vehicle to begin creeping.
Preferably there is provision for an error response to be triggered if the setpoint clutch torque is greater than the creep torque and/or the measuring torque. A particularly preferred provision is that a transition time passes between the triggering of the error and the determination that the setpoint clutch torque exceeds the forenamed torques or one of the forenamed torques. The error response may also be triggered immediately, however.
In a preferred design, the error response is such that the power electronics are shut off and/or the control unit, such as an ASG control unit, is restarted or reset.
Preferably a check is performed, in particular if no error concerning the setpoint clutch torque has been detected, to determine whether the actually existing clutch torque or actual clutch torque exceeds the clutch torque. It is particularly preferred that, a check is performed to ascertain whether the actual clutch torque exceeds the setpoint clutch torque by more than a predefined amount. These exemplary checks may be performed directly or indirectly. For example, in an indirect check the actual clutch torque is directly measurable. With an indirect examination it is possible for example to check whether the setpoint clutch torque brings about a suitable or predefined clutch position.
The actual clutch torque is preferably the torque transferred by the clutch, and particularly preferably the torque transferable by the clutch.
In a preferred design, to check the actual clutch torque it is possible to check whether the setpoint clutch position is correctly regulated in the position regulating circuit of the clutch actuator.
If an error is detected in this or a similar check, preferably an error response is triggered.
Preferably, the start monitoring has neutral gear monitoring.
A preferred provision is that in conjunction with this neutral gear monitoring a check is performed to determine whether a gear should be selected in the transmission unit with the clutch entirely or partially engaged.
For example, this check may be performed on the basis of the setpoint gear positions or on the basis of control signals for transmission actuators, or in some other manner.
Also preferably, in particular if no error has been detected, a check is performed in conjunction with the neutral gear monitoring to determine whether the neutral gear may be confirmed to be in the neutral alley by a slight movement, in particular a tentative movement.
The following section describes some exemplary functionalities and characteristics which may exist individually or in any combination in an electronic safety system.
It should be remarked, however, that the electronic safety system may also be designed differently or have other features.
The electronic safety system may be intended for preventing safety-critical situations such as those caused for example by CPU errors or errors of the main processor.
The electronic safety system preferably has a redundant processor, which may be a duplicate of the main processor or not a full duplicate of the main processor. Preferably, the electronic safety system has a redundant shut-off path.
A preferred design provides that the electronic control unit has a main processor. Preferably, there is function software stored in this main processor that is assigned to a function level. The function software or function level may assume control functionalities, for example that of a computerized clutch unit or an automated gearbox or the like, independently of the electronic safety system.
There is preferably also monitoring software in the main processor as a component of the electronic safety system.
A preferred provision is that this monitoring software is able to communicate with the function software or the function level.
Another preferred provision is that a monitoring processor, which is assigned to the electronic safety system, exists outside the main processor. In a preferred design, this monitoring processor communicates with the monitoring software in the form of a question-and-answer game, in which the monitoring processor directs questions to the monitoring software and the monitoring software transmits back corresponding responses. To this end there may for example be provision for desired responses to be stored in the monitoring processor, which are compared with the responses of the monitoring software. The responses of the monitoring software may be retrieved for example from a storage device.
A preferred design provides that the electronic safety system causes the electronic control unit to be shut off or reset if the electronic safety system detects an error. A preferred provision is that the electronic control unit has actuators having electric motors or is linked thereto, and that the final stages of these actuators are shut off if the electronic safety system detects an error.
In a preferred design, the hardware structure of the electronic safety system is based on a 1-½ processor concept.
The following section depicts some exemplary error situations that are detectable with the electronic safety system. It should be pointed out in this connection that the electronic safety system may also be designed in such a way that part of this situation is detectable, or other situations are detectable.
For example, the electronic safety system may be designed so that downshifting the transmission unit into an excessively low gear while driving is prevented. Such a situation may for example be one where at a speed of 150 km/h downshifting from fifth to second gear is prevented.
For example, the electronic safety system may also be designed so that the touch point of a clutch unit or results of touch point adaptations are monitored.
The electronic safety system may also be designed in such a way that in principle and depending on the situation predefined activations of the transmission actuators that could trigger safety-critical situations are prevented.
Also preferred is that the electronic safety system be designed so that a gear indication is monitored. Preferably the electronic safety system is designed so that it recognizes safety-critical situations in advance in such a way that their occurrence is prevented before they actually materialize. For example, operation of actuators or shifting processes of a predefined type may be prohibited to prevent safety-critical situations.
The present invention also provides an electronic safety system for motor vehicles for carrying out one or more of the methods described herein.
The present invention also provides an adapter plug, or connector for connecting a wire harness plug connector with a control unit connector, wherein:                the adapter connector is configured to couple directly with the wire harness plug connector and the control unit connector and to switch predefined electrical signal connections between the control unit and the wire harness;        the adapter connector is configured to enable the electronic control unit to work together with an electronic safety system that has a redundant processor;        the adapter connector is connectable between the wire harness plug connector and the control unit connector in such a way that the adapter plug is coupled with both the wire harness plug connector and the control unit connector via plug connections;        the adapter connector interrupts at least a portion of a plurality of electrical signal connections between the wire harness plug connector and the control unit connector.        
The term “control” (steuern) is used in the present invention in particular to mean “regulate” and/or “control” (regein and/or steuern) as defined in the DIN standard. The same applies to terms derived from the term “control” (steuern).